AZ-900 Practice Test 34 — 15 Questions

Question 1

A company needs to make their web application available with a custom domain name and SSL certificate. Which Azure service provides this capability for App Service?

Accepted Answer

Azure App Service custom domain and SSL binding. Azure App Service natively supports binding a custom domain to your web app and uploading or configuring an SSL/TLS certificate for HTTPS. This is done through the 'Custom domains' and 'TLS/SSL settings' blades in the portal, which directly associate the domain and certificate with the App Service resource, enabling secure access over HTTPS without additional services.

Answer

Azure DNS with Azure CDN

Answer

Azure Front Door

Answer

Azure Key Vault only

Question 2

A company is deploying a critical internal application in Azure. The application will run on two virtual machines. The solution must guarantee that the virtual machines are placed on separate physical servers and separate racks to minimize the impact of hardware failures. Which Azure feature should the company use?

Accepted Answer

Availability set. An availability set ensures that virtual machines are distributed across multiple fault domains (separate physical servers and racks) and update domains within an Azure datacenter. By placing the two VMs in the same availability set, Azure guarantees they will be on different physical hardware, minimizing the impact of a single hardware failure.

Answer

Azure Load Balancer

Answer

Availability zone

Answer

Virtual network

Question 3

Which Azure service enables the creation of private endpoints so that Azure PaaS services like Storage and SQL Database are accessible only through a private IP within a VNet?

Accepted Answer

Azure Private Link with Private Endpoints. Azure Private Link with Private Endpoints is the correct service because it enables you to access Azure PaaS services (e.g., Storage, SQL Database) over a private IP address within your Virtual Network (VNet). This ensures traffic never traverses the public internet, as the private endpoint uses a network interface with a private IP from your VNet, mapping the PaaS service to your VNet.

Answer

VNet Service Endpoints

Answer

Azure Firewall

Answer

Network Security Groups

Question 4

A company is moving from an on-premises data center to the cloud. Previously, they paid a large upfront sum for hardware and then annual maintenance fees. Now they pay a monthly subscription based on actual usage of compute and storage. This shift represents moving from which type of expenditure to which?

Accepted Answer

From CapEx to OpEx. The scenario describes a shift from paying a large upfront sum for hardware (a capital expenditure, or CapEx) to a monthly subscription based on actual usage (an operational expenditure, or OpEx). In cloud computing, CapEx involves significant upfront costs for physical infrastructure, while OpEx involves ongoing, pay-as-you-go costs for services like compute and storage. This transition is a fundamental benefit of cloud adoption, allowing organizations to avoid large initial investments and instead pay for what they consume.

Answer

From OpEx to CapEx

Answer

From variable to fixed costs

Answer

From direct to indirect costs

Question 5

Which Azure service provides a centralized view of all Azure resources and their health status, showing which resources are healthy, degraded, or unavailable?

Accepted Answer

Azure Resource Health. Azure Resource Health is the correct answer because it provides a personalized dashboard that shows the health of your individual Azure resources, indicating whether they are available, degraded, or unavailable. Unlike Azure Service Health, which focuses on Azure service-wide outages, Resource Health gives a resource-by-resource view, including past health events and root cause analyses.

Answer

Azure Monitor

Answer

Azure Service Health

Answer

Azure Advisor

Question 6

A company has virtual machines in a virtual network that run a critical internal application. IT administrators need to securely connect to these VMs from the internet for management purposes. They must not assign public IP addresses to the VMs, and they want to avoid managing SSH or RDP endpoints. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without exposing public IP addresses on the VMs. It eliminates the need for managing public endpoints, as the Bastion service is deployed inside the virtual network and acts as a jump server that brokers the connection. This meets the requirement of secure internet-based management without public IPs or manual SSH/RDP endpoint management.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

Azure Firewall

Question 7

A company wants to store large amounts of unstructured data (e.g., images, videos, documents) that will be accessed from multiple applications over HTTP/HTTPS. The data needs to be highly durable and available. Which Azure storage service should they use?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed for storing massive amounts of unstructured data, such as images, videos, and documents, and it provides native HTTP/HTTPS access via REST APIs. It offers industry-leading durability (99.9999999999% for RA-GRS) and high availability, making it the correct choice for this scenario.

Answer

Azure SQL Database

Answer

Azure Files

Answer

Azure Disk Storage

Question 8

Which Azure service provides a managed Apache Kafka-as-a-service offering that allows existing Kafka applications to work without code changes?

Accepted Answer

Azure Event Hubs with Kafka protocol support. Azure Event Hubs with Kafka protocol support provides a fully managed, Apache Kafka-compatible endpoint that allows existing Kafka producer and consumer applications to connect without any code changes. This service leverages the Kafka protocol 1.0 and later, enabling seamless migration of Kafka workloads to Azure while benefiting from Event Hubs' scalability and security features.

Answer

Azure HDInsight with Kafka

Answer

Azure Service Bus

Answer

Azure Event Grid

Question 9

A retail company has 50 on-premises servers in multiple branch offices that run legacy applications that cannot be migrated to Azure. The company wants to govern these servers using the same Azure Policy and tagging standards that they use for their Azure virtual machines. They also want to view these servers alongside Azure resources in the Azure portal. Which Azure service should they deploy to extend Azure management capabilities to these on-premises servers?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) control plane to on-premises servers, allowing them to be projected as Azure resources. This enables you to apply Azure Policy and tagging standards to these servers and view them alongside Azure VMs in the Azure portal, even though the legacy applications cannot be migrated.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager

Question 10

A company wants to use cloud services to temporarily increase compute capacity for a promotional event, then reduce resources afterward. They want to pay only for the extra resources used during that event. Which cloud benefit does this scenario best describe?

Accepted Answer

Scalability. This scenario describes scalability, specifically the ability to scale out (increase capacity) for a promotional event and then scale in (reduce resources) afterward, paying only for what is used. Azure Auto Scaling (e.g., Virtual Machine Scale Sets or Azure App Service autoscale) automatically adjusts compute resources based on demand, aligning with the pay-as-you-go model. The key is that resources are temporarily increased and then reduced, which is the hallmark of scalability, not just the ability to handle load.

Answer

High availability

Answer

Agility

Answer

Reliability

Question 11

A company needs to store log files from multiple applications. The logs are accessed infrequently for compliance audits but must be retained for 10 years. Storage cost must be minimized. Which Azure Storage access tier should they use for the blob storage?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is designed for data that is rarely accessed and has a flexible retrieval latency of up to 15 hours, making it ideal for compliance logs that are accessed infrequently but must be retained for 10 years. It offers the lowest storage cost among all Azure Blob Storage access tiers, which directly minimizes storage costs for long-term retention. The Hot, Cool, and Cold tiers are progressively more expensive and are optimized for more frequent access patterns, not for archival scenarios.

Answer

Hot tier

Answer

Cool tier

Answer

Cold tier

Question 12

A company runs a critical application on Azure VMs. They need to ensure that if one VM fails, the application continues to serve users with another VM. The VMs should be placed in a configuration that protects against failures within a single datacenter. Which feature should they use?

Accepted Answer

Availability Set. An Availability Set ensures that VMs are distributed across multiple fault domains (separate racks with independent power, cooling, and network) and update domains within a single Azure datacenter. This protects against hardware failures or maintenance events within that datacenter, so if one VM fails, another in a different fault domain continues serving users.

Answer

Availability Zone

Answer

Resource Group

Answer

Scale Set

Question 13

Which Azure service provides a content delivery network (CDN) that caches static content at edge locations worldwide to reduce latency for users?

Accepted Answer

Azure CDN. Azure CDN is the correct answer because it is specifically designed as a content delivery network that caches static content (such as images, CSS, JavaScript files) at edge locations worldwide. By distributing cached copies closer to users, it reduces latency and offloads origin server traffic. Azure Front Door also uses edge caching but is primarily a global load balancer and application delivery controller, not a dedicated CDN service.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Question 14

Which Azure governance concept ensures that access to resources is granted only to users who need it for their job function?

Accepted Answer

Principle of least privilege. The principle of least privilege is an Azure governance concept that ensures users are granted only the minimum permissions necessary to perform their job functions. In Azure, this is implemented through Azure RBAC (Role-Based Access Control), where custom or built-in roles define specific actions allowed on resources, preventing over-permissioning.

Answer

Defense in depth

Answer

Role inheritance

Answer

Separation of duties

Question 15

What is the purpose of Azure Private DNS zones?

Accepted Answer

To provide DNS name resolution for resources within Azure virtual networks privately. Azure Private DNS zones provide DNS name resolution within a virtual network without requiring a custom DNS solution. They allow you to use your own domain names (e.g., contoso.internal) and automatically resolve them for resources inside the VNet, ensuring that DNS queries never leave the Azure network boundary. This is correct because the primary purpose is private, internal resolution, not public hosting or security filtering.

Answer

To host public-facing domain names and DNS records

Answer

To filter DNS requests for potentially malicious domains

Answer

To translate domain names for cross-region traffic routing